METHODS AND COMPUTING DEVICES TO REGULATE PACKETS IN A SOFTWARE DEFINED NETWORK

• US 20170331838A1
• Filed: 12/01/2014
• Published: 11/16/2017
• Est. Priority Date: 12/01/2014
• Status: Abandoned Application

• Current Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: SCHNEIDER, Peter
• Application Number:
  US15/532,344
• Publication Number:
  US 20170331838A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 45/34 Source routing
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method to allow applications to regulate packets in a software defined network includes receiving a request from an application to regulate at least some of the packets, the request including at least one of a destination address range including at least one destination address, and a source address range including at least one source address, for the packets. The method further includes executing the request if it is permitted by at least one permission out of a set of permissions, wherein the permission includes a rule stating at least one type of packet regulation request that is allowed for a set of packets, the set specified by at least one of a source address range and a destination address range, the source address range including at least one source address and the destination address range including at least one destination address. A computing device can be configured to carry out the method.

Claims

1. A processor implemented method, to allow applications to regulate packets in a software defined network, comprising:

receiving a request from an application to regulate at least some of the packets, the request including at least one of a destination address range including at least one destination address, and a source address range including at least one source address, for the packets;

executing the request if it is permitted by at least one permission out of a set of permissions, wherein the permission includes a rule stating at least one type of packet regulation requests that is allowed for a set of packets, the set specified by at least one of a source address range and a destination address range, the source address range including at least one source address and the destination address range including at least one destination address.

2. A method according to claim 1, wherein a permission includes at least one identifier specifying an application for which the permission is applicable, and wherein the request is associated with an identifier identifying the requesting application, and wherein the method further comprises executing the request, if a permission exists that has the same identifier that is associated with the requesting application.

3. A method according to claim 2, further comprising:

making a secure connection with the requesting application, using a security protocol that allows to identify and authenticate the requesting application and ensure the integrity of requests received from the requesting application; and

accepting the request for further processing if it has been received correctly via the secure connection.

4. A method according to claim 2, wherein the request is cryptographically signed by the requesting application and the method further comprises accepting the request for further processing if the signature can be successfully verified.

5. A method according to claim 1, wherein the request includes a timestamp, and the method further comprises accepting the request for further processing if it is, according to this timestamp, not older then a specified time.

6. A method according to claim 1, wherein the request includes a sequence number, and the method further comprises:

comparing the sequence number with at least one sequence number received in preceding requests; and

accepting the request for further processing if the sequence number is valid according to a chosen policy.

7. The method according to claim 1, wherein the at least one type of packet regulation request includes at least one of:

blocking the packets, rate limiting the packets, diverting the packets to another destination, and reserving a bandwidth for the packets.

8. A computing device to allow applications to regulate packets in a software defined network, comprising:

a processor configured to;

receive a request from an application to regulate at least some of the packets, the request including at least one of a destination address range including at least one destination address, and a source address range including at least one source address, for the packets;

execute the request if it is permitted by at least one permission out of a set of permissions, wherein the permission includes a rule stating at least one type of packet regulation request that is allowed for a set of packets, the set specified by at least one of a source address range and a destination address range, the source address range including at least one source address and the destination address range including at least one destination address.

9. A computing device according to claim 8, wherein a permission includes at least one identifier specifying an application for which the permission is applicable, and wherein the request is associated with an identifier identifying the requesting application, and wherein the processor is further configured to execute the request, if a permission exists that has the same identifier that is associated with the requesting application.

10. A computing device according to claim 9, wherein the processor is further configured to:

make a secure connection with the requesting application, using a security protocol that allows to identify and authenticate the requesting application and ensure the integrity of requests received from the requesting application; and

accept the request for further processing if it has been received correctly via the secure connection.

11. A computing device according to claim 9, wherein the request is cryptographically signed by the requesting application and the processor is further configured to accept the request for further processing if the signature can be successfully verified.

12. A computing device according to claim 8, wherein the request includes a timestamp, and the processor is further configured to accept the request for further processing if it is, according to this timestamp, not older then a specified time.

13. A computing device according to claim 8, wherein the request includes a sequence number, and the processor is further configured to:

compare the sequence number with at least one sequence number received in preceding requests; and

accept the request for further processing if the sequence number is valid according to a chosen policy.

14. A computing device according to claim 8, wherein the at least one type of packet regulation request includes at least one of:

blocking the packets, rate limiting the packets, diverting the packets to another destination, and reserving a bandwidth for the packets.

15. A computer readable medium, including instructions to allow applications to regulate packets in a software defined network, wherein execution of the instructions by at least one processor causes the at least one processor to:

receive a request from an application to regulate at least some of the packets, the request including at least one of a destination address range including at least one destination address, and a source address range including at least one source address, for the packets;

execute the request if it is permitted by at least one permission out of a set of permissions, wherein the permission includes a rule stating at least one type of packet regulation request that is allowed for a set of packets, the set specified by at least one of a source address range and a destination address range, the source address range including at least one source address and the destination address range including at least one destination address.